Dashboard guides

Withdrawal approval emails

Skip manual approval holds for trusted customer emails.

The Withdrawal approval email allowlist lets you self-serve a list of customer emails on Dashboard → Organization (/dashboard/organization). When a custodial withdraw’s customer email matches an active entry, Cheddar skips manual approval holds — without changing destination-address checks, low-liquidity holds, or risk screening.

This is not the same as your organization’s whitelisted withdrawal addresses (destination addresses managed by the Cheddar team). See Organization security.

Manage the allowlist

On the Organization security page, find Withdrawal approval email allowlist:

  1. Enter a Customer email and click Add email.
  2. Active entries appear in the table with Remove to soft-archive an email.

Removed entries are archived, not deleted. Re-adding the same email restores it.

How matching works

Matching uses the customer’s organizationExternalEmail — the email Cheddar stores for that customer, typically set when you first create a deposit address:

  • Pass customerEmail on POST /deposit (optional; normalized to lowercase).
  • If the customer has no email on file, allowlist entries never apply.

Only emails on your organization’s allowlist are checked. Another organization’s list does not affect your customers.

What is overridden

For a matching customer email, custodial POST /withdraw skips:

  • requireApproval: true — the withdraw is not held for manual approval.
  • Customer USD withdraw threshold — over-threshold holds that would normally land in Transactions to Approve.

See Withdrawals & approvals for API usage and webhooks when approval is required.

What is not overridden

Even with an allowlisted email, withdraws can still be held or blocked by:

  • Destination-address whitelist — toAddress must still be allowed for your org.
  • Low liquidity — insufficient balance in the hot wallet.
  • Risk screening — flagged funds may still return 451 or other holds.